Sniffnet — network traffic monitor

Linux / Modern CLI Tools / sniffnet.html

Cross-platform network traffic monitor built with Rust. Visualizes bandwidth and connection information via TUI.

Basic Information

What is this program?

Sniffnet is an open-source tool for real-time monitoring of network traffic on servers and desktops. Written in Rust, it is stable and visually displays bandwidth usage, connected remote hosts, and protocol distribution using only a terminal TUI, without a GUI.

It integrates information from existing tools like iftop and nload into a more intuitive interface. You can filter by specific hosts, ports, or protocols to view detailed traffic, and set alert rules to receive warnings when thresholds are exceeded.

What problem does it solve?

• Identifies the cause of sudden server bandwidth increases at the process or host level.
• Determines which remote IP exchanges the most data.
• Allows intuitive observation of abnormal traffic patterns (e.g., DDoS, scanning).
• Enables visual network monitoring even in server environments without a GUI.

Key Features

Real-time Bandwidth Graph

Displays upload and download speeds as real-time graphs.

• Use Case: Visually tracking traffic surge periods.
• Result: View bandwidth usage over time via graphs.
• Limitation: Historical data is not stored long-term (real-time only).

Connection & Host Filtering

Filter by specific IP, port, or protocol to view only relevant traffic.

• Use Case: Focused analysis of communications with suspicious remote hosts.
• Result: Irrelevant traffic is removed, leaving only key information.
• Limitation: Filter syntax may not be intuitive.

Alert Rule Configuration

Displays alerts when bandwidth or connection count exceeds thresholds.

• Use Case: Immediately detecting abnormal traffic during continuous monitoring.
• Result: Identify anomalies without manual checks.
• Limitation: Alerts are displayed only within the TUI; email/webhook notifications are not supported.

Security-Focused Design

Open-source with security-audited code; does not transmit user data externally.

• Use Case: Monitoring locally without connecting to external services.
• Result: Can be used without privacy concerns.
• Limitation: Requires traffic capture privileges (root or cap_net_raw).

Installation and Execution

Ubuntu / Debian (Binary)

Download and install the binary from the official release.

# Download Linux binary from GitHub releases
# https://github.com/GyulyVGC/sniffnet/releases
chmod +x sniffnet
sudo mv sniffnet /usr/local/bin/

# Run (requires traffic capture privileges)
sudo sniffnet

cargo (Build from Source)

Build in a Rust environment.

cargo install sniffnet
sudo sniffnet

macOS / Homebrew

Install from the Homebrew tap.

brew install sniffnet

Practical Usage Examples

Basic Execution and Bandwidth Check

Monitor traffic on all interfaces in real-time.

# Run with root privileges
sudo sniffnet

# After launching, select an interface (e.g., eth0)
# Displays real-time upload/download graphs

Check Traffic with a Specific Host

Analyze connections with a suspicious remote IP.

# After launching Sniffnet, set filters in the TUI
# 1. Select Interface (e.g., eth0)
# 2. In the Hosts tab, check top communicating hosts
# 3. Click the relevant IP → view detailed traffic graph

Isolate Traffic by Port

Monitor traffic only on a specific service port.

# Apply port filter in Sniffnet TUI
# Example: Display only HTTP (port 80) traffic
# Network → Filters → Port: 80
# View real-time connections, speed, and packet count for that port